Windows Escalate UAC Protection Bypass (In Memory Injection) Abusing WinSXS

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/exe' class MetasploitModule 'Windows Escalate UAC Protection Bypass In Memory Injection abusing WinSXS', 'Description' = %q This module will...

Microsoft Office Outlook Security Bypass Vulnerability

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. A security bypass vulnerability exists in the implementation of Microsoft Outlook when it does not properly handle in-memory objects, where an attacker could execute arbitrary commands via...

Microsoft Office Web Apps Server 2013 Service Pack 1 RCE Vulnerability (KB4011231)

This host is missing an important security update according to Microsoft KB4011231 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Internet Explorer Scripting Engine Memory Corruption (CVE-2017-11793)

A remote code execution vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to the way Microsoft Internet Explorer handles objects in memory. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page...

CVE-2016-3104

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service memory consumption and process termination by leveraging in-memory database representation when authenticating against a non-existent database...

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge HTML-based. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who...

PT-2017-18435

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description An information disclosure issue exists due to improper handling of objects in memory by Microsoft Edge. This could allow an attacker to obtain information that could be used to further...

PT-2017-18453

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description An information disclosure issue exists due to Microsoft Edge's improper handling of objects in memory. This could allow an attacker to obtain information that could be used to further...

Apache Struts 2 REST Plugin XStream Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Struts 2 REST Plugin XStream RCE', 'Description' = %q Apache Struts versions 2.5 through 2.5.12 using the REST plugin are vulnerable to a...

Koadic C3 COM Command & Control – JScript RAT

Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host a.k.a. JScript/VBScript, with compatibility in t...

PT-2017-18452

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description An information disclosure issue exists due to Microsoft Edge's improper handling of objects in memory. This could allow an attacker to obtain information that could be used to further...

PT-2017-18462

Name of the Vulnerable Software and Affected Versions Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 versions Gold, 1511, 1607, and 1703 Windows Server 2016 Description The issue arises from the improper handling of objects i...

Microsoft Edge Memory Corruption Vulnerability

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...

Microsoft Office Outlook Information Disclosure Vulnerability

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. Microsoft Office Outlook has a security vulnerability in the way in-memory content is disclosed, which allows remote attackers to exploit the vulnerability by submitting a special request ...

Microsoft Edge Remote Code Execution Vulnerability (CNVD-2017-14639)

Microsoft Edge is the web browser built into the Windows 10 version. Microsoft Edge fails to properly handle in-memory objects and has a remote code execution vulnerability in its implementation that could lead an attacker to execute arbitrary code in the current user context...

Microsoft Edge Memory Corruption Vulnerability

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...

[SECURITY] Fedora 24 Update: redis-3.2.8-1.fc24

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Microsoft Word Multiple Remote Code Execution Vulnerabilities (KB3191945)

This host is missing an important security update according to Microsoft KB3191945 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Security Advisory 4025685: Windows Vista (June 2017)

The remote Windows Vista host is missing a security update. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in Microsoft Internet Explorer due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit...

Microsoft Edge Memory Corruption Vulnerability

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the...